I'm trying to do penetration testing of our ASP.NET web-site to check for security loopholes (specifically for SQL injections). We bought a commercial web scanner tool (IBM Rational AppScan), however it only does black box scanning for IIS and fails to detect SQL injections in certain scenarios.
What we're looking for is a similar tool to AppScan, but it should also be able to 'attach' to an IIS process (or SQL Server DB that we're using as a back end) and detect whether or not a certain HTTP request generated an actual SQL injection.
Looks like the latest version of AppScan (8.5) does it but only for Java-based web services. We need something that can work in IIS/SQL Server environment.